CVE-2025-68945: 
NixOS vulnerability analysis and mitigation

CVE-2025-68945 is an information disclosure vulnerability in Gitea that allows anonymous (unauthenticated) users to access private user projects without authorization. It affects all Gitea versions before 1.21.2 and was publicly disclosed on December 26, 2025. The vulnerability is classified as Moderate severity with a CVSS v3.1 base score of 5.3 (NVD) or 5.8 (GitHub Advisory, using a Changed scope vector) (Github Advisory, Red Hat Bugzilla).

The root cause is a missing access control check (CWE-359: Exposure of Private Personal Information to an Unauthorized Actor) in Gitea's project visibility enforcement logic. The fix, implemented in pull request #28423, added permission checks for private user projects across both web routes and API endpoints, indicating that the visibility gate was simply absent for certain code paths (Gitea PR #28423). An unauthenticated attacker can exploit this by directly navigating to a private user's project URL over the network — no credentials, special privileges, or user interaction are required. The patch was backported to the v1.21 release branch and shipped in v1.21.2 (Gitea Release v1.21.2).

Successful exploitation allows any anonymous network user to view project data belonging to private Gitea users, resulting in a confidentiality breach. Exposed information may include project names, descriptions, task boards, and associated metadata that the user intended to keep private. There is no integrity or availability impact; however, the exposed data could facilitate targeted attacks, social engineering, or reconnaissance against affected users or organizations (Github Advisory, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-68945. The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of near-term exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Because exploitation requires only knowledge of a target username and no authentication, the barrier is low for opportunistic access, but the limited impact scope reduces attacker incentive.

1. Reconnaissance: Identify a Gitea instance running a version prior to 1.21.2 (e.g., by checking the Gitea version footer or API endpoint /api/v1/version).
2. Identify target user: Enumerate or guess a valid Gitea username whose projects are set to private.
3. Access private project: As an unauthenticated user, navigate directly to the target user's project URL (e.g., https://<gitea-host>/<username>/-/projects) without providing any credentials.
4. Collect information: Browse the exposed project boards, task names, descriptions, and associated metadata that should have been restricted to authorized users only (Gitea PR #28423, Github Advisory).

• Network: Unauthenticated HTTP GET requests to /<username>/-/projects or equivalent project endpoints from external or unexpected IP addresses in Gitea access logs.
• Logs: Gitea access logs showing repeated anonymous (no session cookie / no Authorization header) requests to project URLs belonging to users with private visibility settings.
• Logs: Unusual volume of project page accesses from a single IP or user-agent string without corresponding authentication attempts.

The primary remediation is to upgrade Gitea to version 1.21.2 or later, which includes the fix from pull request #28423 that adds the missing permission checks for private user projects (Gitea Release v1.21.2). No official configuration-based workaround has been published; however, operators unable to upgrade immediately could restrict unauthenticated access to the Gitea instance at the network or reverse-proxy level (e.g., requiring authentication before reaching the application). Monitoring access logs for anonymous requests to project endpoints is advisable as a detection measure until patching is complete.

Red Hat tracked the vulnerability via their Bugzilla system (Bug 2425474) and published a security advisory, rating it medium severity (Red Hat Bugzilla). The GitHub Advisory Database published GHSA-7xq4-mwcp-q8fx on the same day as the CVE disclosure. No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability database entries.